CVE-2022-50743

Vulnerability

In the Linux kernel's erofs filesystem, a memory leak vulnerability exists in the pcluster (page cluster) management code. The function z_erofs_register_pcluster() can register a pcluster as non-inline (ztailpacking = false) but with a block address of zero (map->m_pa = zero). This causes the pcluster's index to be zero, incorrectly marking it as inline even though it is not. Subsequent operations in z_erofs_do_read_page() and z_erofs_readahead() then increment the reference count for the workgroup associated with this pcluster, but the reference is never decremented because the pcluster is treated as inline [1].

Exploitation

An attacker can trigger this condition by constructing a malicious erofs image that satisfies the syzkaller reproducer: a scenario where a non-inline pcluster has a zero block address. This leads to the memory leak as described. The vulnerability is triggered during filesystem access operations (readahead (such as reading or readahead) when the kernel attempts to process the crafted image. No special privileges beyond mounting the crafted filesystem are required for the leak to occur [1].

Impact

Successfully exploiting this vulnerability causes a memory leak. Each trigger of the code path leaks a pcluster structure (136 bytes) that is never freed. Repeated exploitation can exhaust memory, potentially resulting in a denial of service (DoS) condition. The leak is detectable via kernel memory debugging tools such as kmemleak [1].

Mitigation

The fix is included in the Linux kernel commit c42c0ffe81176940bd5dead474216b7198d77675, which adds a check to reject pclusters with a block address of zero when they are not inline, preventing the registration of such misconfigured pclusters and thus eliminating the leak. Users should apply the latest stable kernel updates that contain this patch [1].